fix: Encode invisible ASCII control characters

Author: franky47

packages/nuqs/src/url-encoding.test.ts

@@ -24,6 +24,12 @@ describe('url-encoding/encodeQueryValue', () => {
     expect(encodeQueryValue('<')).toEqual(encodeURIComponent('<'))
     expect(encodeQueryValue('>')).toEqual(encodeURIComponent('>'))
   })
+  test('hidden ASCII characters are encoded', () => {
+    const chars = Array.from({ length: 32 }, (_, i) => String.fromCharCode(i))
+    chars.forEach(char => {
+      expect(encodeQueryValue(char)).toBe(encodeURIComponent(char))
+    })
+  })
   test('Alphanumericals are passed through', () => {
     const input = 'abcdefghijklmnopqrstuvwxyz0123456789'
     expect(encodeQueryValue(input)).toBe(input)

packages/nuqs/src/url-encoding.ts

@@ -42,6 +42,8 @@ export function encodeQueryValue(input: string) {
       .replace(/`/g, '%60')
       .replace(/</g, '%3C')
       .replace(/>/g, '%3E')
+      // Encode invisible ASCII control characters
+      .replace(/[\x00-\x1F]/g, char => encodeURIComponent(char))
   )
 }